Encapsulated Metadata Headers for Predictive SD-WAN Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Edge nodes in a network lack the ability to share deep packet inspection (DPI) knowledge with intermediate nodes due to space constraints in traditional IPv4/IPv6/SD-WAN/VXLAN packet headers, leading to sub-optimal visibility and policy enforcement, especially in high-throughput environments.
Innovation Solution
Implement an extended packet header with enriched metadata generated from DPI insights, allowing intermediate nodes to gain detailed knowledge of traffic flows without performing DPI, using fixed-length metadata wrappers like NSH 210 for easy processing and extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If deep packet inspection is performed by edge nodes to gain detailed traffic flow knowledge, then visibility and policy enforcement capability are improved, but the ability to share this knowledge with intermediate nodes is lost due to header space constraints
Solution Approach 1:
The patent segments the packet header into traditional header fields and an extended metadata section. The metadata section is further divided into fixed-length wrappers that can be independently processed. This segmentation allows DPI knowledge to be extracted and stored separately from the original packet structure, enabling intermediate nodes to access this information without modifying the core packet handling path.
Solution Approach 2:
The patent introduces a new dimensional layer by appending metadata wrappers to the existing packet header structure. This extended dimension carries DPI knowledge without affecting the original packet's routing and forwarding functions. The metadata section operates in a parallel dimension, allowing information sharing between edge and intermediate nodes simultaneously.
2Quantity of substance
If traditional packet headers are used to transport traffic, then network infrastructure compatibility is maintained, but space for carrying enriched metadata is insufficient
Solution Approach 1:
The patent implements nesting by placing metadata wrappers inside the existing packet header structure. The fixed-length wrappers are embedded within the header space, allowing multiple levels of encapsulation. This nested structure enables the header to carry both traditional packet information and enriched metadata without requiring complete header redesign.
Solution Approach 2:
The extended packet header structure serves multiple functions simultaneously: traditional routing and forwarding, DPI knowledge transport, and policy enforcement. The fixed-length wrappers can be interpreted differently by various network functions, making the header universally applicable across different network operations while maintaining infrastructure compatibility.
3Loss of information
If intermediate nodes perform deep packet inspection to gain traffic visibility, then policy enforcement capability is improved, but processing complexity and throughput impact increase
Solution Approach 1:
The patent performs DPI and metadata extraction as a preliminary action at edge nodes before traffic reaches intermediate nodes. By pre-processing and extracting only the necessary metadata fields, the heavy inspection workload is completed in advance, allowing intermediate nodes to operate with lighter processing requirements and maintain higher throughput.
Solution Approach 2:
The patent extracts only the essential metadata fields from the full packet payload and places them in fixed-length wrappers. This extraction separates the critical information needed for policy enforcement from the bulk of the packet data, allowing intermediate nodes to process only the condensed metadata rather than performing complete DPI operations.
Data Source
AI summary
Methods are provided for predictive policy enforcement using encapsulated metadata. The methods involve obtaining a packet of an encapsulated traffic flow that is transported in a software-defined wide area network (SD-WAN) or in a cloud network. The packet includes a network virtualization tunneling header with an appended service plane protocol header and a payload. The methods further involve extracting, from the appended service plane protocol header, without performing deep packet inspection, enriched metadata that includes fields for one or more attributes related to a source of the packet or a destination of the packet, determining at least one network policy based on the enriched metadata, and applying, to the packet, the at least one network policy that relates to gathering analytics and/or transporting the encapsulated traffic flow to the destination.